Cyber Security attacks and computer security, Lecture notes of Cybercrime, Cybersecurity and Data Privacy

Download Cyber Security attacks and computer security and more Lecture notes Cybercrime, Cybersecurity and Data Privacy in PDF only on Docsity! CYBER SECURITY UNIT-1 Is there security problem in Computing? What does security mean? – Attacks - The meaning of computer Security, Computer Criminals, Methods of Defense – Hardware and Software security. Is There a Security Problem in Computing? • The risks involved in computing • The goals of secure computing: confidentiality, integrity, availability • The threats to security in computing: interception, interruption, modification, fabrication • Controls available to address these threats: encryption, programming controls, operating systems, network controls, administrative controls, law, and ethics. 1.1 What Does "Secure" Mean? Protecting assets was difficult and not always effective in older days. Today, however, asset protection is easier, with many factors working against the potential criminal. The techniques of criminal investigation have become so effective that a person can be identified by genetic material (DNA), fingerprints, retinal patterns, voice, a composite sketch, ballistics evidence, or other hard-to-mask characteristics. The assets are stored in a safer form. Protecting Valuables Protecting Money vs. Protecting Information Characteristic Bank Protecting money People protecting information Size and portability Sites storing money are large, unwieldy, not at all portable. Items storing valuable assets are very small and portable. Ability to avoid physical contact Difficult. When banks deal with physical currency, a criminal must physically demand the money and carry it away from the bank's premises. Simple. When information is handled electronically, no physical contact is necessary. Money can be transferred through computers, mail, or telephone. Value of assets Very high. Variable, from very high to very low depending upon the information. Protecting our valuables, whether they are expressed as information or in some other way, ranges from quite unsophisticated to very sophisticated. As software consumers, we find that the lack of protection is all the more dangerous when we are not even aware that we may be susceptible to software piracy or corruption. Throughout this, we look at examples of how computer security affects our lives directly and indirectly. And we examine techniques to prevent security breaches or at least to mitigate their effects. We address the security concerns of software practitioners as well as those professionals, managers, and users whose products, services, and well-being depend on the proper functioning of computer systems. By studying this, you can develop an understanding of the basic problems underlying computer security and the methods available to deal with them. To product we have to do the following • examine the risks of security in computing • consider available countermeasures or controls • stimulate thought about uncovered vulnerabilities • identify areas where more work is needed In this chapter, we begin by examining what kinds of vulnerabilities computing systems are prone to. We then consider why these vulnerabilities are exploited: the different kinds of attacks that are possible. This chapter's third focus is on who is involved: the kinds of people who contribute to the security problem. Finally, we introduce how to prevent possible attacks on systems. Characteristics of Computer Intrusion Any part of a computing system can be the target of a crime. When we refer to a computing systema[1] we mean a collection of hardware, software, storage media, data, and people that an organization uses to perform computing tasks. Sometimes, we assume that parts of a computing system are not valuable to an outsider, but often we are mistaken. For instance,we tend to think that the most valuable property in a bank is the cash, gold, or silver in the vault. But in fact the customer information in the bank's computer may be far more valuable. • Stored on paper, recorded on a storage medium, resident in memory, or transmitted over T telephone lines or satellite links, this information can be used in myriad ways to make money illicitly. particular disk file. MODIFICATION If an unauthorized party not only accesses but tampers with an asset, the threat is a modification. Example: Someone might change the values in a database, alter a program so that it performs an additional computation, or modify data being transmitted electronically. It is even possible to modify hardware. Some cases of modification can be detected with simple measures, but other, more subtle, changes may be almost impossible to detect. FABRICATION Finally, an unauthorized party might create a fabrication of counterfeit objects on a computing system. The intruder may insert spurious transactions to a network communication system or add records to an existing database. Sometimes these additions can be detected as forgeries, but if skillfully done, they are virtually distinguishable from the real thing. Method, Opportunity, and Motive A malicious attacker must have three things: 1.Method: the skills, knowledge, tools, and other things with which to be able to pull off the attack. 2.Opportunity: the time and access to accomplish the attack. 3.Motive: a reason to want to perform this attack against this system. Finally, it is difficult to determine motive for an attack. Some places are what are called "attractive targets," meaning they are very appealing to attackers. Popular targets include law enforcement and defense department computers, perhaps because they are presumed to be well protected against attack. Other systems are attacked because they are easy. And other systems are attacked simply because they are there: random, unassuming victims. Protecting against attacks can be difficult. Anyone can be a victim of an attack perpetrated by an unhurried, knowledgeable attacker. In the remainder of this book we discuss the nature of attacks and how to protect against them. 1.3. The Meaning of Computer Security The purpose of computer security is to devise ways to prevent the weaknesses from being exploited. To understand what preventive measures make the most sense, we consider what we mean when we say that a system is "secure." Security Goals We use the term "security" in many ways in our daily lives. A "security system" protects our house, warning the neighbors or the police if an unauthorized intruder tries to get in. When we talk about computer security, we mean that we are addressing three important aspects of any computer-related system: confidentiality, integrity, and availability. 1.Confidentiality ensures that computer-related assets are accessed only by authorized parties. That is, only those who should have access to something will actually get that access. By "access," we mean not only reading but also viewing, printing, or simply knowing that a particular asset exists. Confidentiality is sometimes called secrecy or privacy. 2.Integrity means that assets can be modified only by authorized parties or only in authorized ways. In this context, modification includes writing, changing, changing status, deleting, and creating. 3.Availability means that assets are accessible to authorized parties at appropriate times. In other words, if some person or system has legitimate access to a particular set of objects, that access should not be prevented. For this reason, availability is sometimes known by its opposite, denial of service. Security in computing addresses these three goals. One of the challenges in building a secure system is finding the right balance among the goals, which often conflict. For example, it is easy to preserve a particular object's confidentiality in a secure system simply by preventing everyone from reading that object. However, this system is not secure, because it does not meet the requirement of availability for proper access. That is, there must be a balance between confidentiality and availability. But balance is not all. In fact, these three characteristics can be independent, can overlap (as shown in Figure 1-3), and can even be mutually exclusive. For example, we have seen that strong protection of confidentiality can severely restrict availability. Let us examine each of the three qualities in depth. Relationship Between Confidentiality, Integrity, and Availability. Confidentiality You may find the notion of confidentiality to be straightforward: Only authorized people or systems can access protected data. However, as we see in later chapters, ensuring confidentiality can be difficult. For example, who determines which people or systems are authorized to access the current system? By "accessing" data, do we mean that an authorized party can access a single bit? the whole collection? pieces of data out of context? Can someone who is authorized disclose those data to other parties? Integrity In integrity, we may mean that the item is • precise • accurate • unmodified • modified only in acceptable ways • modified only by authorized people • modified only by authorized processes • consistent • internally consistent • meaningful and usable Integrity can also mean two or more of these properties. Welke and Mayfield recognize three particular aspects of integrity authorized actions, separation and protection of resources, and error detection and correction. Availability Availability applies both to data and to services (that is, to information and to information processing), and it is similarly complex. As with the notion of confidentiality, different people expect availability to mean different things. For example, an object or service is thought to be available if • It is present in a usable form. • It has capacity enough to meet the service's needs. • It is making clear progress, and, if in wait mode, it has a bounded waiting time. • The service is completed in an acceptable period of time. • We can construct an overall description of availability by combining these goals. We say a data item, service, or system is available if There is a timely response to our request. • Resources are allocated fairly so that some requesters are not favored over others. • The service or system involved follows a philosophy of fault tolerance, whereby hardware or software faults lead to graceful cessation of service or to work-arounds rather than to crashes and abrupt loss of information. • The service or system can be used easily and in the way it was intended to be used. • Concurrency is controlled; that is, simultaneous access, deadlock management, and exclusive access are supported as required. Vulnerabilities It is sometimes easier to consider vulnerabilities as they apply to all three broad categories of system resources (hardware, software, and data), rather than to start with the security goals themselves. The types of vulnerabilities apply to the assets of hardware, software, and data. These three assets and the connections among them are all potential security weak points. Data Confidentiality Data can be gathered by many means, such as tapping wires, planting bugs in output devices, sifting through trash receptacles, monitoring electromagnetic radiation, bribing key employees, inferring one data point from other values, or simply requesting the data. Because data are often available in a form people can read, the confidentiality of data is a major concern in computer security. Data Integrity Stealing, buying, finding, or hearing data requires no computer sophistication, whereas modifying or fabricating new data requires some understanding of the technology by which the data are transmitted or stored, as well as the format in which the data are maintained. For instance, we saw in our truncated interest example that a criminal can perform what is known as a salami attack: The crook shaves a little from many accounts and puts these shavings together to form a valuable result, like the meat scraps joined in a salami. Networks Networks are specialized collections of hardware, software, and data. Each network node is itself a computing system; as such, it experiences all the normal security problems. In addition, a network must confront communication problems that involve the interaction of system components and outside resources. The problems may be introduced by a very exposed storage medium or access from distant and potentially untrustworthy computing systems. Access Access to computing equipment leads to three types of vulnerabilities. In the first, an intruder may steal computer time to do general-purpose computing that does not attack the integrity of the system itself. This theft of computer services is analogous to the stealing of electricity, gas, or water. 1.4. Computer Criminals For the purposes of studying computer security, we say computer crime is any crime involving a computer or aided by the use of one. Although this definition is admittedly broad, it allows us to consider ways to protect ourselves, our businesses, and our communities against those who use computers maliciously. Amateurs Amateurs have committed most of the computer crimes reported to date. Most embezzlers are not career criminals but rather are normal people who observe a weakness in a security system that allows them to access cash or other valuables. In the same sense, most computer criminals are ordinary computer professionals or users who, while doing their jobs, discover they have access to something valuable. Crackers or Malicious Hackers System crackersa[2] often high school or university students, attempt to access computing facilities for which they have not been authorized. Cracking a computer's defenses is seen as the ultimate victimless crime. The perception is that nobody is hurt or even endangered by a little stolen machine time. Crackers enjoy the simple challenge of trying to log in, just to see whether it can be done. Most crackers can do their harm without confronting anybody, not even making a sound. In the absence of explicit warnings not to trespass in a system, crackers infer that access is permitted. Career Criminals By contrast, the career computer criminal understands the targets of computer crime. Criminals seldom change fields from arson, murder, or auto theft to computing; more often, criminals begin as computer professionals who engage in computer crime, finding the prospects and payoff good. There is some evidence that organized crime and international groups are engaging in computer crime. Recently, electronic spies and information brokers have begun to recognize that trading in companies' or individuals' secrets can be lucrative. Terrorists The link between computers and terrorism is quite evident. We see terrorists using computers in three ways: • targets of attack: denial-of-service attacks and web site defacements are popular for any political organization because they attract attention to the cause and bring • undesired negative attention to the target of the attack. • propaganda vehicles: web sites, web logs, and e-mail lists are effective, fast, and inexpensive ways to get a message to many people. • methods of attack: to launch offensive attacks requires use of computers. We cannot accurately measure the amount of computer-based terrorism because our definitions and measurement tools are rather weak. Still, there is evidence that all three of these activities are increasing. 1.5. Methods of Defense Harm occurs when a threat is realized against a vulnerability. To protect against harm, then, we can neutralize the threat, close the vulnerability, or both. The possibility for harm to occur is called risk. We can deal with harm in several ways. We can seek to • prevent it, by blocking the attack or closing the vulnerability • deter it, by making the attack harder but not impossible • deflect it, by making another target more attractive (or this one less so) • detect it, either as it happens or some time after the fact • recover from its effects Controls To consider the controls or countermeasures that attempt to prevent exploiting a computing system's vulnerabilities, we begin by thinking about traditional ways to enhance physical security. In the Middle Ages, castles and fortresses were built to protect the people and valuable property inside. The fortress might have had one or more security characteristics, including • a strong gate or door, to repel invaders • heavy walls to withstand objects thrown or projected against them • a surrounding moat, to control access • arrow slits, to let archers shoot at approaching enemies • crenellations to allow inhabitants to lean out from the roof and pour hot or vile liquids on attackers • a drawbridge to limit access to authorized people • gatekeepers to verify that only authorized people and goods could enter Encryption We noted earlier that we seek to protect hardware, software, and data. We can make it particularly hard for an intruder to find data useful if we somehow scramble the data so that interpretation is meaningless without the intruder's knowing how the scrambling was done. Indeed, the most powerful tool in providing computer security is this scrambling or encoding. Encryption is the formal name for the scrambling process. We take data in their normal, unscrambled state, called cleartext, and transform them so that they are unintelligible to the outside observer; the transformed data are called enciphered text or ciphertext. Encryption clearly addresses the need for confidentiality of data. Additionally, it can be used to ensure integrity; data that cannot be read generally cannot easily be changed in a meaningful manner. Furthermore, as we see throughout this book, encryption is the basis of protocols that enable us to provide security while accomplishing an important system or network task. Software Controls If encryption is the primary way of protecting valuables, programs themselves are the second facet of computer security. Programs must be secure enough to prevent outside attack. They must also be developed and maintained so that we can be confident of the programs' dependability. Program controls include the following: • internal program controls: parts of the program that enforce security restrictions, such as access limitations in a database management program • operating system and network system controls: limitations enforced by the operating system or network to protect each user from all other users networks and the communications media by which networked computers are connected. Network security has become very significant because of the rapid growth in use of networks, especially the Internet. Encryption In-Depth Chapter 12 builds on the simple encryption methods and terminology presented in Chapter 2. It progresses from theoretical encryption algorithms to current standard practices in the field. We study what makes a cryptosystem secure enough for commercial use; for protecting government data; or for securing your own private, personal information. Throughout the book, we raise issues related to the important problems in computer security today. When the solution is known, we describe it or at least give you pointers to a fuller description of the solution. At the same time, we discuss work in progress so that you can watch the media and the literature for significant achievements in improving computer security. It is important to remember that computer security is a relatively new field that is gaining prominence as computing itself becomes pervasive. The speed of new development in computing far outpaces capabilities in computer security. It sometimes seems as if each advance in computing brings with it new security problems. In a sense, this is true. However, there is reason to be optimistic. The fundamental work in security provides tools (such as encryption and operating system features) that form the basis of controls for these new problems as the problems arise. Part of the excitement of computer security is that there are always new challenges to address. 1.7. Summary Computer security attempts to ensure the confidentiality, integrity, and availability of computing systems' components. Three principal pieces of a computing system are subject to attacks: hardware, software, and data. These three, and the communications among them, constitute the basis of computer security vulnerabilities. In turn, those people and systems interested in compromising a system can devise attacks that exploit the vulnerabilities. This chapter has identified four kinds of attacks on computing systems: interception, interruption, modification, and fabrication. Four principles affect the direction of work in computer security. By the principle of easiest penetration, a computing system penetrator will use whatever means of attack is the easiest; therefore, all aspects of computing system security must be considered at once. By the principle of timeliness, a system must be protected against penetration only so long as the penetration has value to the penetrator. The principle of effectiveness states that controls must be usable and used in order to serve their purpose. And the weakest link principle states that security is no stronger than its weakest point. Controls can be applied at the levels of the data, the programs, the system, the physical devices, the communications links, the environment, and the personnel. Sometimes several controls are needed to cover a single vulnerability, and sometimes one control addresses many problems at once. 1.8. Terms and Concepts Virus, Trojan horse, worm, rabbit, salami, firewall, spray paint, mental poker, orange book, wardialer. The vocabulary of computer security is rich with terms that capture your attention.Also, the field is filled with acronyms: DES, AES, RSA, TCSEC, CTCPEC, ITSEC, PEM, PGP, andSSE CMM, to list a few. All of these are explained in this book. 1.9. Where the Field Is Headed The number of computer security professionals is growing rapidly but so, too, is the number of attackers. The U.S. CERT and its counterpart organizations around the world do an exceptional job of tracking serious system vulnerabilities and countermeasures. Several efforts are underway to categorize and catalog computer security incidents and vulnerabilities (for example, Landwehr et al. [LAN94]). Being able to sort and correlate incident information is critical to successful forensic analysis of large incidents. Obviously, the popular attack point today is computer networks and, specifically, the Internet. Do not be misled, however, into thinking that all computer security is network security. As you will see throughout the remainder of this book, network security problems are often just the latest instantiation of computer security problems that predate the rise of the Internet problems such as identification and authentication, limited privilege, and designing for security. So although the problems of networks are pressing, they are long-standing, open problems.